Linux kernel (drivers/infiniband/hw/irdma): The pseudo memory regions that back a QP/CQ/SRQ have no real hardware key

Impact

The pseudo memory regions that back a QP/CQ/SRQ have no real hardware key, but the core still exposes them as normal MRs. A tenant that calls re-register on one drives a control-plane command against key 0 - an unvalidated operation on adapter-global state that other tenants on the same NIC depend on.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on an Intel irdma node calls ibv_rereg_mr on the MR it registered for its own QP/CQ/SRQ buffers. Purely local to the tenant; no fabric peer or host root.

What to do

Update to 6.6.148 or later, or a stable kernel carrying fb46d134e1b8 / b5029e91c634, and reboot. Interim: drop /dev/infiniband/* from untrusted containers on irdma nodes.

References